Skip to content

docs(cre): document secrets limits, batch caps and troubleshooting - #4374

Open
wentzeld wants to merge 4 commits into
mainfrom
docs/cre-secrets-limits
Open

wentzeld wants to merge 4 commits into
mainfrom
docs/cre-secrets-limits

Conversation

@wentzeld

@wentzeld wentzeld commented Oct 29, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Documents the limits that apply to CRE secrets. The values live only on the Service Quotas page. Other pages describe the limit in words and link
there, so there is one place to update.

  • Service Quotas: the concurrency row now describes in-flight fetch calls (it limited calls, not secrets). A single or batch call each counts as one
    fetch call. Added the per-request secrets limit (VaultRequestBatchSizeLimit) and an Aside that explains how the stored, per-upload, per-batch-fetch
    and per-execution limits differ.
  • Deployed secrets guide: new "Secrets limits" section (no values) and a "Fetching multiple secrets" section with TypeScript and Go examples.
    Troubleshooting entries for namespace mismatch, batch size, a partly missing batch, the call limit (including how it appears on confidential workflows)
    and the generic closing hints on secrets errors.
  • CLI reference, secrets overview and confidential workflow guides: note the limits that apply and link to Service Quotas.
  • Go SDK reference: example used Namespace "default" while the CLI always writes to "main"; now "main".

Notes for reviewers

  • VaultRequestBatchSizeLimit is the internal setting name for the per-request limit. Please confirm it should appear in public docs.
  • The call-limit troubleshooting entry says a Confidential Workflow currently shows "relay quorum unreachable" instead of naming the limit. That is a
    known bug, so please drop that line once it is fixed.
  • Prettier check passes on all changed files.

Clarify that SecretsConcurrencyLimit counts in-flight fetch calls, and that a single or batch call each counts as one against Secrets.CallLimit.
  Document the 10-secret cap per batch fetch and per cre secrets file.

Add a Fetching multiple secrets section to the deployed secrets guide, note that Confidential Workflows share the same limits, and fix the Go SDK
  example namespace.

Add troubleshooting entries for namespace mismatches, batch size, partly missing batches, the call limit and the generic closing hints on secrets
  errors. Update lastModified dates.
Add a Secrets limits at a glance section and cross-references that explain the 100-secret storage limit, the 10-secret upload limit per cre
  secrets file, and the 10-secret batch fetch limit are separate limits.
@vercel

vercel Bot commented Oct 29, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
documentation Ready Ready Preview Oct 30, 2026 4:46am UTC

Request Review

Remove repeated limit numbers from the secrets guides, CLI reference and
  confidential workflow guides. Those pages now describe which limits exist and link to Service Quotas, so the values only need updating in one place.
@wentzeld
wentzeld marked this pull request as ready for review October 30, 2026 04:42
@wentzeld
wentzeld requested review from a team as code owners October 30, 2026 04:42

This branch was successfully deployed

1 active deployment
Preview — 6d7dfb97 Deployed Oct 30, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant